The Design of Rijndael
In the past few months I have been working adding encryption to data transfers between storage servers. I am using the .NET platform and developing the software in C#.
Initially I decided to use the Triple Data Encryption Standard (3DES) for the data transfers. In practice for most end user applications any type of proven encryption mechanism should suffice. The data being stored by the servers does not contain national security sensitive materials. For most users and companies, attempting to break a 3DES encrypted data transfer should be a formidable task. For the National Security Agency (NSA), well, probably all commercial available encryption software is not secure at all.
The book is quite interesting and to some extent easy to read. The authors came up with a nice layout and explained the mathematics they used in the algorithms. Was able to follow most of the explanations. Something that came through is that the design of new cryptographic algorithms should be left to mathematicians. It is very important to make the algorithms public for peer review. That way if a flaw is found the algorithm can be updated or discarded.
The process how Rijndael became AES was an open contest. The book covers the process how it was selected. It also describes some other derivatives from the Rijndael family.
The authors describe and show how the Rijndael algorithm went through several iterations with previous implementations. This is something that software engineers and product managers should understand and apply to their development processes. It is very difficult (not to say just unfeasible) to come up with a very good product without previous versions. Each version needs improvements in different aspects. After a few versions a very good product / algorithms is typically realized.
Another interesting point is the idea that the designers of Rijndael tried keeping the algorithm and its implementation as simple as possible. In practice this idea, which seems to be reasonable is seldom put in practice by software developers. Most of the time there is a pet technology that might not fit with the task at hand, but is used. The results are typically convoluted and complex software. The KISS (Keep It Simple Stupid) rule should always be followed.
In conclusion, if the reader is interested in cryptography and has some level of mathematical background, go for it a get a copy of the book. One of the appendices contains the listing of the source code in C programming language written by one of the authors.
